gistfile1.txt

Index: ext/spl/spl_iterators.c
===================================================================
--- ext/spl/spl_iterators.c     (revision 316291)
+++ ext/spl/spl_iterators.c     (working copy)
@@ -1868,7 +1868,7 @@
        spl_dual_it_object *intern;
        char       *subject, tmp[32], *result;
        int        subject_len, use_copy, count = 0, result_len;
-       zval       subject_copy, zcount, *replacement;
+       zval       subject_copy, zcount;

        if (zend_parse_parameters_none() == FAILURE) {
                return;
@@ -1935,10 +1935,17 @@
                RETVAL_BOOL(count > 1);
                break;

-       case REGIT_MODE_REPLACE:
-               replacement = zend_read_property(intern->std.ce, getThis(), "replacement", sizeof("replacement")-1, 1 TSRMLS_CC);
+       case REGIT_MODE_REPLACE: {
+               zval *replacement = zend_read_property(intern->std.ce, getThis(), "replacement", sizeof("replacement")-1, 1 TSRMLS_CC);
+               zval replacement_copy;
+               if (Z_TYPE_P(replacement) != IS_STRING) {
+                       replacement_copy = *replacement;
+                       zval_copy_ctor(&replacement_copy);
+                       replacement = &replacement_copy;
+                       convert_to_string(replacement);
+               }       
+
                result = php_pcre_replace_impl(intern->u.regex.pce, subject, subject_len, replacement, 0, &result_len, -1, &count TSRMLS_CC);
-               
                if (intern->u.regex.flags & REGIT_USE_KEY) {
                        if (intern->current.key_type != HASH_KEY_IS_LONG) {
                                efree(intern->current.str_key);
@@ -1951,7 +1958,11 @@
                        MAKE_STD_ZVAL(intern->current.data);
                        ZVAL_STRINGL(intern->current.data, result, result_len, 0);
                }
+               if (replacement == &replacement_copy) {
+                       zval_dtor(replacement);
+               }
                RETVAL_BOOL(count > 0);
+               }
        }

        if (intern->u.regex.flags & REGIT_INVERTED) {